Protected tunnels
Clean traffic, delivered straight to your network.
Once our edge has filtered your traffic, it reaches your routers over GRE or WireGuard tunnels from our scrubbing network. Replies go back the same way, so your servers keep answering from their protected addresses.
- One tunnel with every plan
- Ready-made Linux and RouterOS config
- Alerts when a tunnel goes down
Up and running in four steps.
Tunnels are created and changed in the panel, or from the API. There is nothing to install and no hardware to buy.
- 1
Create the tunnel
Enter the public IPv4 address your router sends from, give the tunnel a label and tick the prefixes it should carry.
- 2
Paste the config
Copy the generated Linux or RouterOS 7 configuration to your router. It sets up a tunnel to each of our ends.
- 3
Watch it come up
The tunnel shows Pending while our network builds it, then Active, with the state of every end.
- 4
Clean traffic flows
Filtered traffic for your prefixes arrives through the tunnel, and replies go back the way they came.
GRE or WireGuard, your pick.
Both deliver your IPv4 and IPv6 prefixes the same way. Pick the one your network already speaks.
GRE
The standard for routers in a data center. Every router speaks it.
- Transport
- IP protocol 47
- Encryption
- None, for the lowest overhead
- Your side
- A public IPv4 address
- Speaks it
- Linux, MikroTik, Juniper, Cisco and nearly every router
WireGuard
Encrypted on the way to you, and at home on servers and smaller sites.
- Transport
- UDP
- Encryption
- Built in, with modern cryptography
- Your side
- Works from behind NAT
- Speaks it
- Linux 5.6 and later, MikroTik RouterOS 7, OPNsense and more
Configuration you can paste.
Every tunnel in the panel comes with ready-made configuration for Linux and MikroTik RouterOS 7. It builds a tunnel to each of our ends, routes replies from your prefixes back through them and clamps TCP MSS, so large packets still get through.
ip tunnel add orbitel0 mode gre local 192.0.2.10 remote 198.51.100.1 key 41922 ttl 255
ip link set orbitel0 mtu 1476 up
ip tunnel add orbitel1 mode gre local 192.0.2.10 remote 198.51.100.65 key 41922 ttl 255
ip link set orbitel1 mtu 1476 up
ip route replace default nexthop dev orbitel0 nexthop dev orbitel1 table 100
ip rule add from 203.0.113.0/24 lookup 100
ip -6 route replace default nexthop dev orbitel0 nexthop dev orbitel1 table 100
ip -6 rule add from 2001:db8:4f00::/48 lookup 100
iptables -t mangle -A FORWARD -o orbitel0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1436
iptables -t mangle -A FORWARD -o orbitel1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1436Built for production networks.
Tunnels are the part of the path you run, so the panel shows you everything about them and tells you when something changes.
An end on every scrubbing node
Each scrubbing node that carries your prefixes has its own end of the tunnel, and the panel shows the state of every one.
Alerts when a tunnel goes quiet
If a tunnel stops passing traffic on every node, you hear about it by email, Discord, Slack or webhook, whichever you set up.
MTU taken care of
Each tunnel lists the MTU and TCP MSS clamp to use, and the generated config sets both, so large packets survive when path MTU discovery fails.
You choose what each tunnel carries
Pick the prefixes each tunnel delivers, and add tunnels to reach other sites, routers or data centers.
No inner addressing
Tunnels are unnumbered, so there is no transfer network to plan. Give your servers addresses from your own prefixes.
Automate it
Create, change and remove tunnels from the API with a scoped key, and push your changes to the network on demand.
At a glance.
- Protocols
- GRE or WireGuard
- Included
- One tunnel with every plan
- Extra tunnels
- $15 a month each, for more sites, routers or data centers. See pricing
- Your side
- A router or Linux server with a public IPv4 address outside your protected prefixes
- Addressing
- Unnumbered, with no transfer network to plan
- IP versions
- IPv4 and IPv6 prefixes through the same tunnel
- Configuration
- Generated for Linux and MikroTik RouterOS 7
- Health
- Up or down for every scrubbing node, with alerts when a tunnel goes quiet
Questions, answered.
Can’t find what you need? Talk to an engineer.
What do I need on my side?
A router or Linux server with a public IPv4 address outside your protected prefixes. For GRE, make sure IP protocol 47 is allowed through any firewall in front of it.
Which routers work?
Anything that speaks GRE or WireGuard, from Linux servers to MikroTik, Juniper and Cisco. The panel writes Linux and RouterOS 7 configuration for you, and our engineers help with the rest.
Which MTU should I use?
The one on your tunnel card. Each tunnel lists its MTU and TCP MSS clamp, and the generated configuration sets both for you.
Can I connect more than one site?
Yes. Every plan includes one tunnel, and extra tunnels are $15 a month each. You choose which prefixes each one carries.
What happens if a tunnel goes down?
Its state changes in the panel straight away. If it stops passing traffic on every scrubbing node, you also get an alert on every channel you set up.